Resilience has become a buzzword in both business and cybersecurity circles. Like many trends, the idea of resilience has become popular because it gets to the heart of a very real struggle: if preventing disruption becomes impossible, can your business at least survive it?
The newly released 2026 Semperis Ransomware Risk Report studied 1 200 organisations that had experienced at least one successful ransomware attack in the past 12 months. Respondents named the evolving threat environment (including AI-based threats) as the top challenge to operational resilience. This isn’t surprising.
I don’t believe there are any information security professionals today who believe it is possible to secure your cyber environment to such an extent that you can completely prevent a breach. Attackers’ adoption of AI technology – weaponised in 84% of attacks, according to report respondents – has put the final nail in that coffin. One must assume breach.
Other findings from the Semperis study are just as sobering:
- Of the respondents, 69% were attacked multiple times during the past 12 months;
- A ransom was paid by 59%, and more than half of those paid multiple times;
- Physical or psychological intimidation was used in 40% of attacks, as often as the threat of system lockouts or sabotage; and
- Attackers followed through on their threats in more than 50% of cases.
So how can cybersecurity and IT leaders use this data to increase their resilience? I think the biggest lesson here is that your organisation must be well prepared to respond decisively to an attack.
Identity is central to this challenge. Attackers targeted identity infrastructure in 87% of reported cases, because it provides a direct path to privilege escalation and broader access across the environment.
Yet at most 60% of respondents had documented recovery procedures for compromised identity systems, and just 42% had solutions to automate identity recovery, which is a very time-consuming process when done manually.
This is the reality leaders must confront: a cyber incident is a business crisis, not a technology crisis.
One of the best ways to engage the business is through regular, realistic crisis management exercises and documented crisis management plans.
However, a well-defined plan is not just another document that sits untouched until the next incident. Nor does it merit only a cursory review; it must be tested regularly to ensure it remains current.
Semperis study respondents said that a lack of defined roles and responsibilities, cross-team communication gaps and outdated response plans were major blockers to effective cyber crisis response. A realistic exercise, then, should:
- Prioritise the recovery of the critical business outcomes required to restore a minimum viable company;
- Define internal and external stakeholders;
- Define delegations of authority;
- Prepare pre-approved, out-of-band communications;
- Establish an isolated, governed channel for crisis coordination; and
- Document technology recovery steps, including the restoration of a trusted identity system.
This is precisely why realistic exercises matter: resilience is not achieved through technology alone.
It’s about enabling the right people with both the processes and technology to respond quickly and appropriately when bad things happen. The Semperis study shows that ransomware attackers are now putting extreme pressure on organisations’ employees, as well as threatening data and operations. Crisis planning and rehearsals must take these new threats into account.
In the tabletop exercises I facilitate, I inject unexpected yet realistic scenarios to increase the pressure. For example:
- Threat actors increase their ransom demand.
- A regulator is informed of the attack.
- A customer demands answers.
- The company’s standard communications platform becomes unavailable.
These moments expose assumptions that are easy to miss in a planning session. In the heat of a crisis, executives might disagree about authority. Technical teams might focus on containment while business leaders are trying to keep essential services running. Legal, communications, HR and operations might discover that they have different definitions of “recovered”.
Resolving these tensions before a real crisis is how resilience is built. Record the gaps, assign owners and test fixes. Comfort should not be the objective. Rehearse the unpleasant and the unthinkable while there is still time to learn, adapt and improve.
About Semperis
Semperis is a global leader in identity-driven cyber resilience, dedicated to helping organisations secure their most critical asset: Active Directory and identity systems. With cyberattacks increasingly targeting identity infrastructure as the fastest route to compromise, Semperis provides a trusted shield that goes beyond detection, enabling rapid response and full recovery to keep businesses operational. To find out more about Semperis, contact its South African partner, Solid8 Technologies, at [email protected].
